SHA Generator

Generate a SHA-1 hash of a given string.

Hash settings

Rounds

Password tips

1

Change your passwords periodically.

2

Never use the same password on multiple sensitive accounts.

3

Use a password with at least 16 characters. It should contain lowercase letters, uppercase letters, numbers, and symbols.

4

Refrain from saving your password in a web browser (Firefox, Chrome, Internet Explorer, Safari). Instead, use a tool which manages an encrypted password locker.

5

Do not log into sensitive accounts while connected to a public Wi-Fi hotspot.

6

Check that you are using a secure (HTTPS, SSH, SFTP) connection before transmitting your password over the web.

What is SHA-1?

SHA-1 (Secure Hash Algorithm 1) produces a 40-character hexadecimal digest from any input string. It was widely used for data integrity checks and digital signatures, but it's no longer considered collision-resistant enough for security-critical use; modern applications typically prefer SHA-256 or Bcrypt for anything involving passwords or certificates. SHA-1 is still commonly used for non-security purposes like generating checksums or short unique identifiers.

How to use this tool

Enter a string in the input field, choose how many rounds to apply, and click Generate SHA. Each round re-hashes the previous SHA-1 digest. Copy the result using the clipboard icon next to the output field.

Common use cases

  • Generating a checksum to confirm two files or strings are identical.
  • Producing a short, deterministic identifier from a longer piece of text.
  • Reproducing legacy Git or version-control behavior, since Git historically used SHA-1 object hashes.
  • Comparing SHA-1 output against MD5 or SHA-256 to understand digest length differences.

Frequently asked questions

Is SHA-1 secure for passwords or certificates?

No. Major browsers and certificate authorities have deprecated SHA-1 for TLS certificates, and it should not be used for password storage. Use our Bcrypt Hash Generator for passwords instead.

What's the difference between SHA-1 and SHA-256?

SHA-1 produces a 160-bit (40-character hex) digest; SHA-256, part of the SHA-2 family, produces a 256-bit (64-character hex) digest and is significantly more resistant to collision attacks. SHA-256 is the current standard for most security-sensitive use cases.

Has SHA-1 actually been broken?

Yes. Google and CWI Amsterdam publicly demonstrated a practical SHA-1 collision in 2017 (the "SHAttered" attack), which is why it's no longer considered safe for digital signatures or certificate signing.

Why would I still use SHA-1 today?

For non-adversarial use, like generating a quick checksum to detect accidental file corruption or de-duplicate identical text, SHA-1 is still fast and perfectly adequate. It's only unsuitable when someone might deliberately try to forge a matching hash.